ACH is one of my areas of least expertise, but based on what I'm finding I'm not feeling great.

External account transfers (A2A) originated through us, requested in OLB by a scammed accountholder, set up using micro-transactions to verify access to the account at the RDFI. But, the other account is compromised by the same group scamming our accountholder. 10 months later we get a late return request from the RDFI. I'd assume the microtransactions are of no substance to the conversation and we don't have proper authorization. The origination had our accountholders name identified, should have been a flag on their end, I'd think. The accountholder on the other end is a small city and sounds like they had this happening to a significant degree from many other FIs, so not a small account takeover situation.

Since it appears this is a breach of contract issue, the timeline is well within the statute of limitations, so as I'm seeing it, we have nothing to do but return the credits and collect the funds from our accountholder. If I'm missing something, I'd be happy to know it though!

I guess I am a little confused. A breach of what contract and why would you be responsible to the RDFI 10 months later?

I'm confused as well. Breach of warranty would be what I meant.

We're receiving the demand from a $200 billion dollar bank, so there's a general presumption they know what they're talking about, right or wrong. At this point are giving us 10 business days to authorize the late return or a they'll be filing a NACHA violation based on us being unable to present proper authorization. Maybe that's just a scare tactic, nothing we've dealt with at our size, being < $1 billion.

We received a subpoena on this case two months ago, so it blows my mind that they then took another two months to send the request when clearly they were already very well informed of the fraud. Makes it seem like they're trying to save themselves at the cost of anyone else.

Here is more information on NACHA Warranty Claims

On consumer accounts, an RDFI has up to two years to file a warranty claim against the ODFI if they are asserting that we did not have a valid authorization to debit the consumer's account.

This is governed by the Nacha rules. If you were the ODFI (and based on your description, your bank was), your bank made a warranty to the RDFI that the debit entry was authorized. Although they are too late to return it, Nacha rules provide that they can pursue a claim for breach of warranty for 2 years from the date of the entry. Here's a link to a FAQ on the warranty limitation period from Nacha:
Nacha Warranty limitation

Yes, we're the ODFI here, originations set up in our OLB to pull payments to a credit card.

Thank you both. I much appreciate independent validation that it is a pursuable claim. Much easier to believe someone without a stake in the outcome! The resources are even better.

not sure where you are located, but you should look for whomever is your local nacha affilate (i.e. umacha, epcor, epay, sfe, etc). they are always a great resource for assistance in issues such as this.

and the big bank is corect, if you can't furnish the proof of authorization within 10 days, you do have to provide authorization for late return or they are correct to file a nacha rules violation against you. the good news is, if the situation were reversed, you can do the same against them. no one wants a nacha rules violation.